Silobreaker, a leading security and threat intelligence technology company trusted by threat analysts, security leaders and risk teams, today announced that the NATO Cooperative Cyber Defence Centre of Excellence (CCDCOE) has published a new policy brief assessing the cybersecurity posture, challenges and best practices of maritime port infrastructure across NATO and partner countries.

The research was supported by threat intelligence contributions from Silobreaker, whose data and analysis informed the report’s threat landscape assessment and policy recommendations.

The brief, titled “Addressing State-Linked Threats to Critical Maritime Port Infrastructure,” highlights the growing risks posed by state-linked cyber actors, financially motivated criminals and politically driven hacktivists. It underscores the strategic importance of ports, which handle 80% of global trade and serve as critical nodes in NATO’s defence logistics.

Key findings:

• Nearly all surveyed countries reported cyber incidents in the past five years, with access control and vessel traffic management systems identified as key vulnerabilities.
• Many of these attacks are linked to Russia, Iran and China, and involve espionage, disruption and pre-positioning for future attacks.
• Ransomware groups and hacktivist collectives have also disrupted port operations, highlighting the need for coordinated civilian-military responses.
• NATO’s current maritime strategy doesn’t reflect today’s cyber threats. With most ports under civilian control, stronger coordination between NATO and civilian port operators is essential to defend against both physical and cyber threats.

The report recommends updating NATO’s Alliance Maritime Strategy to integrate cybersecurity more fully, along with the establishment of structured threat intelligence-sharing networks, dedicated NATO and port cybersecurity liaisons and international maritime cybersecurity working groups.

To read the full policy brief, click here.

Survey methodology:

The survey was conducted between 29 November 2024 and 14 February 2025, with responses from military and government entities in nine countries. Cyber threat intelligence companies including Silobreaker provided data and threat reports during this research period.

Source: BUSINESS WIRE